Define Policy and Implement Mirroring Strategy for External Toolchain Artifacts

### What

Define and implement a clear policy for handling external toolchain artifacts (SDKs, vendor blobs, GitHub-hosted artifacts) to ensure long-term reproducibility, traceability and hermetic builds across S-CORE repositories.

Currently, several repositories fetch external artifacts directly from:

- Vendor URLs (e.g., QNX SDP downloads)
- GitHub repositories (via git_override)
- Potentially GitHub Release assets (in some repositories)

Even when protected with sha256 or integrity checks, these sources do not guarantee long-term availability.

### How

Step 1 – Inventory External Artifacts
----------------------------------------

Across S-CORE repositories:

- Identify http_archive, archive_override, git_override, and toolchain fetches
- Classify:
- Vendor SDK downloads (e.g. QNX SDP)
- GitHub repository fetches
- GitHub Release assets
- Other external binary blobs

Produce an inventory list.

Step 2 – Define Policy
-------------------------

Propose and align on one of the following policies:

Option A – Strict Mirroring

- All external toolchain artifacts must be mirrored into an S-CORE-controlled artifact store.
- MODULE.bazel must reference only mirror URLs.
- sha256 / integrity remains mandatory.

Option B – Conditional Mirroring

- Mirroring required only for:
- Safety-relevant toolchains
- Release branches
- Development dependencies may use upstream sources.

Option C - Other

Step 3 – Implement Mirror (If Required)
--------------------------------------------

If mirroring is agreed:

- Create an S-CORE “distfiles” mirror (artifact repository)
- Mirror:
- Vendor SDK archives (if licensing permits)
- Toolchain tarballs
- GitHub-based artifacts
- Update MODULE.bazel references to mirror URLs
- Keep all sha256 / integrity checks

Step 4 – CI / Policy Enforcement (optional but recommended imho)
---------------------------------------------------------------------------

- Add CI check preventing direct vendor URLs in MODULE.bazel
- Allow only approved mirror domains

### Estimates for realization

Resources

- Infra team
- Repo maintainers
- Possibly legal/licensing clarification for SDK redistribution

### Category

- [ ] Affects Detailed Design

### Requirements / Architecture

- [x] Requirements / Architecture are not affected by this change?